From 23ee99a3900d6ac4103cb7e4a6739c570a914352 Mon Sep 17 00:00:00 2001
From: cproudlock <cproudlock@localhost>
Date: Thu, 15 Oct 2026 15:32:10 -0400
Subject: [PATCH] Clonezilla: warn while the default share password is in use;
 prepare-boot-tools.sh no longer fails on an empty tool folder

The final listing of an empty boot-tools/blancco (no Blancco ISO yet)
failed under pipefail and made the script exit 1 after a good download.
---
 playbook/pxe_server_setup.yml | 10 ++++++++++
 scripts/prepare-boot-tools.sh |  6 +++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/playbook/pxe_server_setup.yml b/playbook/pxe_server_setup.yml
index 20e4bf3..5d9bab5 100644
--- a/playbook/pxe_server_setup.yml
+++ b/playbook/pxe_server_setup.yml
@@ -269,6 +269,16 @@
           Fix it in playbook/site-vars.yml and re-run.
         quiet: yes
 
+    - name: "Clonezilla: WARNING - the default Samba password is in use"
+      # The password is readable from the boot menu by anything on the imaging
+      # LAN and the default is the same at every site. It opens only the
+      # clonezilla share, but each site should set its own.
+      debug:
+        msg: >-
+          !!! WARNING: clonezilla_smb_password is the shipped default. Set a
+          site-specific value in playbook/site-vars.yml and re-run.
+      when: clonezilla_smb_password == "clonezilla-backup"
+
     # --- Re-run safety (nothing below changes the box until these pass) ---
     - name: "Re-run safety: is imaging in progress? (SMB sessions, recent DHCP leases)"
       args:
diff --git a/scripts/prepare-boot-tools.sh b/scripts/prepare-boot-tools.sh
index 3c7d5e3..5e1facf 100755
--- a/scripts/prepare-boot-tools.sh
+++ b/scripts/prepare-boot-tools.sh
@@ -70,7 +70,7 @@ else
     fi
 fi
 
-ls -lh "$OUT_DIR/clonezilla/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs|shimx64' | sed 's/^/    /'
+ls -lh "$OUT_DIR/clonezilla/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs|shimx64' | sed 's/^/    /' || true
 # The shim must be Microsoft-signed (firmware trusts it) and the kernel
 # Debian-signed (the shim trusts that); otherwise Secure Boot refuses them.
 if command -v sbverify >/dev/null && [ -s "$OUT_DIR/clonezilla/shimx64.efi" ]; then
@@ -108,7 +108,7 @@ else
     fi
     rm -rf "$TMPDIR"
 fi
-ls -lh "$OUT_DIR/clonezilla-i686/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs' | sed 's/^/    /'
+ls -lh "$OUT_DIR/clonezilla-i686/" 2>/dev/null | grep -E 'vmlinuz|initrd|squashfs' | sed 's/^/    /' || true
 
 # --- Blancco Drive Eraser ---
 echo ""
@@ -307,7 +307,7 @@ else
     echo "    Usage: $0 /path/to/DriveEraser.iso"
 fi
 
-ls -lh "$OUT_DIR/blancco/" 2>/dev/null | grep -v '^total' | sed 's/^/    /'
+ls -lh "$OUT_DIR/blancco/" 2>/dev/null | grep -v '^total' | sed 's/^/    /' || true
 
 # --- Summary ---
 echo ""